Hardware Acceleration Device for Denial-Of-Service Attack Identification and Mitigation

2. The method of claim 1, wherein the updating the rate based counters based on the application layer protocol request is done by performing a longest prefix match on the domain name and the path string.

3. The method of claim 2, wherein said performing a longest prefix match is performed by a pattern matching hardware module of the hardware acceleration sub-system and wherein the method further comprises making use of the pattern matching hardware module to perform intrusion detection processing on network traffic received by the network security device.

5. The method of claim 1, wherein the application layer protocol request comprises a Hypertext Transport Protocol (HTTP) request.

6. The method of claim 1, wherein the network security device is within a data center, wherein the hardware acceleration sub-system is implemented within a network interface card (NIC), wherein the processor comprises an embedded processor within the NIC and wherein said detecting and mitigating a DOS attack is performed on behalf of a host within the data center without using a central processing unit (CPU) of the network security device.

7. The method of claim 1, wherein the challenged message comprises a Hypertext Markup Language (HTML) form or a Uniform Resource Locator (URL) to be presented to an end user of the client.

8. The method of claim 1, wherein the hardware acceleration sub-system learns the rate thresholds associated with the rate-based counters, the rate-based counters corresponding to any or a combination of a request rate, a packet byte rate, and a session count.

10. The network security device of claim 9, wherein the updating the rate-based counters based on an application layer protocol request is done by performing a longest prefix match on a domain name and a path string.

11. The network security device of claim 10, wherein said performing a longest prefix match is performed by a pattern matching hardware module of the hardware acceleration sub-system and wherein the pattern matching hardware module performs intrusion detection processing on network traffic received by the network security device.

13. The network security device of claim 9, wherein the application layer protocol request comprises a Hypertext Transport Protocol (HTTP) request.

14. The network security device of claim 9, wherein the network security device is within a data center, wherein the hardware acceleration sub-system is implemented within a network interface card (NIC), wherein the processing resource comprises an embedded processor within the NIC and wherein said detecting and mitigating a DOS attack is performed on behalf of a host within the data center without using a central processing unit (CPU) of the network security device.

15. The network security device of claim 9, wherein said performing a longest prefix match is performed by a pattern matching hardware module of the hardware acceleration sub-system and wherein the pattern matching hardware module performs intrusion detection processing on network traffic received by the network security device.

16. The network security device of claim 9, wherein the challenged message comprises a Hypertext Markup Language (HTML) form or a Uniform Resource Locator (URL) to be presented to an end user of the client.

17. The network security device of claim 9, wherein the hardware acceleration sub-system learns the rate thresholds associated with the rate-based counters, the rate-based counters corresponding to any or a combination of a request rate, a packet byte rate, and a session count.

19. The non-transitory computer-readable storage medium of claim 18, wherein the updating the rate based counters based on the application layer protocol request is done by performing a longest prefix match on the domain name and the path string.

20. The non-transitory computer-readable storage medium of claim 19, wherein said performing a longest prefix match is performed by a pattern matching hardware module of the hardware acceleration sub-system and wherein the method further comprises making use of the pattern matching hardware module to perform intrusion detection processing on network traffic received by the network security device.